Overwatch began when we were working with risk and threat intel teams at Google, Stripe, and government. We experienced the immense challenge every fraud and cyber threat analyst faces: manually parsing through an ocean of data to find valuable insights and filter out the noise. This included using many of the feeds and tools out there that were often very expensive, noisy, keyword-based, and lacked accurate entity extraction or advanced query features.
Most threat intelligence tools utilize thousands of keywords and teams of analysts to manually sift through torrents of alerts. These alerts are usually individual posts on various platforms across news, social media, deep and dark web sources that have some matching keyword. This is full of false positives, requiring many hours to wade through to figure out what intel matters most to our users, why, and what they can do next.
Overwatch uses an alternative approach by layering AI agents and NLP techniques, including a combination of multifarious datasets, cluster analysis, topic modeling, Retrieval Augmented Language Models (RALM) and domain knowledgeable agents.
This allows us to (1) Filter through OSINT in real time to identify events and narratives that matter to our users, and write reports on what they could do about it; (2) Identify dark web and deep web threats, fraud methods, new tactics, and compromised accounts, stolen checks, and credentials affecting our users or their peers; (3) Send an alert any time one a 3rd party supplier or parts of the tech stack are impacted by a widely exploited vulnerability, ransomware attack, or breach; and (4) Track malware and ransomware groups that are actively targeting your industry including Indicators of Compromise (IOCs).
Our intelligence is actionable because the alert comes with the context and important details that an analyst needs to make an informed decision. Being AI-native, we also have a range of chat and data visualization features to effectively function as an intel co-pilot or industry expert. Finally, our in-house intelligence analysts and investigators can assist threat intelligence teams with HUMINT investigations and darkweb acquisition.
Our current customers include internet platforms, financial institutions, and supply chain companies. Within a day of one breach, one of our customers used Overwatch to surface 18,000+ leaked credentials. Another used us to surface fraudulent checks and learn exactly how threat actors were targeting their specific product features.
Our website says “Request a demo” but if you want to poke around on a very basic example of how we’re aggregating dark web, deep web, social, and surface web, log in at https://app.overwatchdata.io/ using these credentials: username: try_overwatch@overwatchdata.io pw: HelloHNWorld
That login is for an un-personalized feed of cyber threat intel (breaches, vulnerabilities, ransomed organizations, and industry updates) that gives you a flavor of not just the kind of information from which we can collect, but more importantly, how our technology prioritizes, clusters, and summarizes alerts for cyber / fraud analysts. Try the chat agent on the left-hand side to parse through the data.
Integration options range from simple dashboard access to our API for those who want to weave our intelligence directly into other products. Pricing is dependent on how complex a threat landscape our users want to monitor and we’re still figuring out how to standardize this but we’ll always do our best for the HN community.
Since the platform is AI-powered, it can also be used for news monitoring, supply chain disruptions, regulatory monitoring, or social media monitoring. We’ve had a lot of experience wrangling text-based feeds and using numerous AI-models (from embeddings, entity extractors, and LLMs) to filter, categorize, cluster, and analyze the data into meaning - so let us know if you’d like to nerd-out or have had any particular challenges. Looking forward to your feedback and questions! Thanks, HN!
PryingDeep is a dark web OSINT tool. It specializes in extracting information depending on modules chosen. Here's an overview of the features:
- Email, PhoneNumber, Wordpress search
- PGP keys, Certificates and 3 different cryptocurrencies (XMR,BTC,ETH) search
- PostgreSQL database, docker container for Tor and docker-compose for the whole project
- A built in exporter, currently only JSON, but possibly more.
- Exporter has support for: offset, limit, query building via the command line, raw-sql and different modules you can specify, e.g you only want emails, you will only get emails and the html webpage
- Collects title, status_code, body and headers from a webpage.
- Extremely customizable, supports multiple url's at once, based of the goColly framework which gives the crawler many options, e.g Debugger, allowed-domains or url-filters.
- Built install module, so there's no need for manually grabbing our config from github.
- Choice to remember previous parameters with our save-config flag.
- Built in queue and once reached max size, crawler will automatically exit.
That's a short overview, but there will be many more features to come as I enjoy working on this project!
Overwatch began when we were working with risk and threat intel teams at Google, Stripe, and government. We experienced the immense challenge every fraud and cyber threat analyst faces: manually parsing through an ocean of data to find valuable insights and filter out the noise. This included using many of the feeds and tools out there that were often very expensive, noisy, keyword-based, and lacked accurate entity extraction or advanced query features.
Most threat intelligence tools utilize thousands of keywords and teams of analysts to manually sift through torrents of alerts. These alerts are usually individual posts on various platforms across news, social media, deep and dark web sources that have some matching keyword. This is full of false positives, requiring many hours to wade through to figure out what intel matters most to our users, why, and what they can do next.
Overwatch uses an alternative approach by layering AI agents and NLP techniques, including a combination of multifarious datasets, cluster analysis, topic modeling, Retrieval Augmented Language Models (RALM) and domain knowledgeable agents.
This allows us to (1) Filter through OSINT in real time to identify events and narratives that matter to our users, and write reports on what they could do about it; (2) Identify dark web and deep web threats, fraud methods, new tactics, and compromised accounts, stolen checks, and credentials affecting our users or their peers; (3) Send an alert any time one a 3rd party supplier or parts of the tech stack are impacted by a widely exploited vulnerability, ransomware attack, or breach; and (4) Track malware and ransomware groups that are actively targeting your industry including Indicators of Compromise (IOCs).
Our intelligence is actionable because the alert comes with the context and important details that an analyst needs to make an informed decision. Being AI-native, we also have a range of chat and data visualization features to effectively function as an intel co-pilot or industry expert. Finally, our in-house intelligence analysts and investigators can assist threat intelligence teams with HUMINT investigations and darkweb acquisition.
Our current customers include internet platforms, financial institutions, and supply chain companies. Within a day of one breach, one of our customers used Overwatch to surface 18,000+ leaked credentials. Another used us to surface fraudulent checks and learn exactly how threat actors were targeting their specific product features.
Our website says “Request a demo” but if you want to poke around on a very basic example of how we’re aggregating dark web, deep web, social, and surface web, log in at https://app.overwatchdata.io/ using these credentials:
username: try_overwatch@overwatchdata.io
pw: HelloHNWorld
That login is for an un-personalized feed of cyber threat intel (breaches, vulnerabilities, ransomed organizations, and industry updates) that gives you a flavor of not just the kind of information from which we can collect, but more importantly, how our technology prioritizes, clusters, and summarizes alerts for cyber / fraud analysts. Try the chat agent on the left-hand side to parse through the data.
Or sign up for a longer trial and preview of our email alerts: https://xryl45u9uep.typeform.com/to/pvtZQyS0. You can also check out our clickthrough demo for dark and deep web intelligence: https://app.storylane.io/share/qyayvtamapis.
Integration options range from simple dashboard access to our API for those who want to weave our intelligence directly into other products. Pricing is dependent on how complex a threat landscape our users want to monitor and we’re still figuring out how to standardize this but we’ll always do our best for the HN community.
Since the platform is AI-powered, it can also be used for news monitoring, supply chain disruptions, regulatory monitoring, or social media monitoring. We’ve had a lot of experience wrangling text-based feeds and using numerous AI-models (from embeddings, entity extractors, and LLMs) to filter, categorize, cluster, and analyze the data into meaning - so let us know if you’d like to nerd-out or have had any particular challenges. Looking forward to your feedback and questions! Thanks, HN!